From bcec8a447992a8e49b421858ef8bf109f79006cf Mon Sep 17 00:00:00 2001 From: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Date: Tue, 29 Mar 2022 09:16:21 -0500 Subject: [PATCH] Linux Shell Evasion Rule Tuning (#1878) * Linux Shell Evasion Rule Tuning * Update execution_python_tty_shell.toml * Update rules/linux/execution_apt_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_apt_binary.toml * Update rules/linux/execution_awk_binary_shell.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_awk_binary_shell.toml * Update rules/linux/execution_c89_c99_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_c89_c99_binary.toml * Update rules/linux/execution_cpulimit_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_cpulimit_binary.toml * Update rules/linux/execution_expect_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_expect_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_expect_binary.toml * Update rules/linux/execution_find_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_find_binary.toml * Update rules/linux/execution_gcc_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_gcc_binary.toml * Update rules/linux/execution_mysql_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_mysql_binary.toml * Update rules/linux/execution_nice_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_nice_binary.toml * Update rules/linux/execution_ssh_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_ssh_binary.toml * Update execution_perl_tty_shell.toml * Update execution_python_tty_shell.toml * Update rules/linux/execution_apt_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_awk_binary_shell.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_c89_c99_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_cpulimit_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_expect_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_find_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_gcc_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_mysql_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_nice_binary.toml Co-authored-by: Justin Ibarra * Update rules/linux/execution_ssh_binary.toml Co-authored-by: Justin Ibarra Co-authored-by: Justin Ibarra --- rules/linux/execution_apt_binary.toml | 7 +++---- rules/linux/execution_awk_binary_shell.toml | 5 ++--- rules/linux/execution_busybox_binary.toml | 4 ++-- rules/linux/execution_c89_c99_binary.toml | 8 ++++---- rules/linux/execution_cpulimit_binary.toml | 8 ++++---- rules/linux/execution_crash_binary.toml | 6 ++---- rules/linux/execution_expect_binary.toml | 8 ++++---- rules/linux/execution_find_binary.toml | 6 +++--- rules/linux/execution_gcc_binary.toml | 6 +++--- rules/linux/execution_mysql_binary.toml | 6 +++--- rules/linux/execution_nice_binary.toml | 5 ++--- rules/linux/execution_perl_tty_shell.toml | 1 - rules/linux/execution_python_tty_shell.toml | 1 - rules/linux/execution_ssh_binary.toml | 6 +++--- rules/linux/execution_vi_binary.toml | 2 +- 15 files changed, 36 insertions(+), 43 deletions(-) diff --git a/rules/linux/execution_apt_binary.toml b/rules/linux/execution_apt_binary.toml index 46819878e..56952c994 100644 --- a/rules/linux/execution_apt_binary.toml +++ b/rules/linux/execution_apt_binary.toml @@ -26,10 +26,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m - [process where process.name : ("apt", "apt-get") and process.args : "changelog"] - [process where process.name : "sensible-pager" and process.args : ("/bin/sh", "/bin/bash") and - process.parent.name : ("apt", "apt-get")] +process where event.type == "start" and process.name == "sensible-pager" and + process.args in ("/bin/sh", "/bin/bash", "/bin/dash", "sh", "bash", "dash") and + process.parent.name in ("apt", "apt-get") and process.parent.args == "changelog" ''' diff --git a/rules/linux/execution_awk_binary_shell.toml b/rules/linux/execution_awk_binary_shell.toml index 966816a7a..ca0b73766 100644 --- a/rules/linux/execution_awk_binary_shell.toml +++ b/rules/linux/execution_awk_binary_shell.toml @@ -25,9 +25,8 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m - [process where process.name : ("nawk", "mawk", "awk", "gawk") and process.args : "BEGIN {system(*)}"] - [process where process.parent.name : ("nawk", "mawk", "awk", "gawk") and process.name : ("sh", "bash")] +process where event.type == "start" and process.name in ("sh", "bash", "dash") and + process.parent.name in ("nawk", "mawk", "awk", "gawk") and process.parent.args : "BEGIN {system(*)}" ''' diff --git a/rules/linux/execution_busybox_binary.toml b/rules/linux/execution_busybox_binary.toml index afd4bb6dd..d6554baed 100644 --- a/rules/linux/execution_busybox_binary.toml +++ b/rules/linux/execution_busybox_binary.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2022/03/15" maturity = "production" -updated_date = "2022/03/15" +updated_date = "2022/03/24" [rule] author = ["Elastic"] @@ -25,7 +25,7 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -process where event.type == "start" and process.name : "busybox" and process.args_count == 2 and process.args : ("/bin/sh", "/bin/ash", "sh", "ash") +process where event.type == "start" and process.name == "busybox" and process.args_count == 2 and process.args in ("/bin/sh", "/bin/ash", "sh", "ash") ''' diff --git a/rules/linux/execution_c89_c99_binary.toml b/rules/linux/execution_c89_c99_binary.toml index c3103f358..b875c8768 100644 --- a/rules/linux/execution_c89_c99_binary.toml +++ b/rules/linux/execution_c89_c99_binary.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2022/03/15" maturity = "production" -updated_date = "2022/03/15" +updated_date = "2022/03/24" [rule] author = ["Elastic"] @@ -25,9 +25,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where process.name :("c89","c99") and process.args == "-wrapper" and process.args : ("sh,-s", "bash,-s", "dash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s")] -[process where process.parent.name : ("bash", "sh", "dash")] +process where event.type == "start" and process.name in ("sh", "dash", "bash") and + process.parent.name in ("c89","c99") and process.parent.args == "-wrapper" and + process.parent.args in ("sh,-s", "bash,-s", "dash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s") ''' diff --git a/rules/linux/execution_cpulimit_binary.toml b/rules/linux/execution_cpulimit_binary.toml index 4e47d5086..c9b503c32 100644 --- a/rules/linux/execution_cpulimit_binary.toml +++ b/rules/linux/execution_cpulimit_binary.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2022/03/17" maturity = "production" -updated_date = "2022/03/17" +updated_date = "2022/03/24" [rule] author = ["Elastic"] @@ -26,9 +26,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where event.type == "start" and process.name == "cpulimit" and process.args == "-f" and process.args : ("/bin/sh", "/bin/bash", "/bin/dash", "sh", "bash", "dash")] -[process where process.parent.name == "cpulimit" and process.name : ("bash", "sh", "dash")] +process where event.type == "start" and process.name in ("bash", "sh", "dash") and + process.parent.name == "cpulimit" and process.parent.args == "-f" and + process.parent.args in ("/bin/sh", "/bin/bash", "/bin/dash", "sh", "bash", "dash") ''' diff --git a/rules/linux/execution_crash_binary.toml b/rules/linux/execution_crash_binary.toml index cd81a0468..346d2b369 100644 --- a/rules/linux/execution_crash_binary.toml +++ b/rules/linux/execution_crash_binary.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2022/03/21" maturity = "production" -updated_date = "2022/03/21" +updated_date = "2022/03/24" [rule] author = ["Elastic"] @@ -25,9 +25,7 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where event.type == "start" and process.name == "crash" and process.args : "-h"] -[process where process.parent.name == "crash" and process.name : "sh"] +process where event.type == "start" and process.parent.name == "crash" and process.parent.args == "-h" and process.name == "sh" ''' diff --git a/rules/linux/execution_expect_binary.toml b/rules/linux/execution_expect_binary.toml index c9797ae79..e758b0898 100644 --- a/rules/linux/execution_expect_binary.toml +++ b/rules/linux/execution_expect_binary.toml @@ -1,6 +1,6 @@ [metadata] creation_date = "2022/03/07" -maturity = "development" +maturity = "production" updated_date = "2022/03/28" [rule] @@ -25,9 +25,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where process.name == "expect" and process.args : "-c" and process.args : ("spawn /bin/sh;interact", "spawn /bin/bash;interact", "spawn /bin/dash;interact", "spawn sh;interact","spawn bash;interact", "spawn dash;interact")] -[process where process.parent.name == "expect" and process.name : ("bash", "sh", "dash")] +process where event.type == "start" and process.name in ("bash", "sh", "dash") and + process.parent.name == "expect" and process.parent.args == "-c" and + process.parent.args in ("spawn /bin/sh;interact", "spawn /bin/bash;interact", "spawn /bin/dash;interact", "spawn sh;interact", "spawn bash;interact", "spawn dash;interact") ''' diff --git a/rules/linux/execution_find_binary.toml b/rules/linux/execution_find_binary.toml index 73cfc3061..a093f7cea 100644 --- a/rules/linux/execution_find_binary.toml +++ b/rules/linux/execution_find_binary.toml @@ -25,9 +25,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where process.name == "find" and process.args : "-exec" and process.args : ("/bin/bash", "/bin/sh", "bash", "sh") and process.args : ";"] -[process where process.parent.name == "find" and process.name : ("bash", "sh")] +process where event.type == "start" and process.name in ("bash", "sh") and + process.parent.name == "find" and process.parent.args == "-exec" and + process.parent.args == ";" and process.parent.args in ("/bin/bash", "/bin/sh", "bash", "sh") ''' diff --git a/rules/linux/execution_gcc_binary.toml b/rules/linux/execution_gcc_binary.toml index 64b52cc0d..423e51f45 100644 --- a/rules/linux/execution_gcc_binary.toml +++ b/rules/linux/execution_gcc_binary.toml @@ -25,9 +25,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where process.name == "gcc" and process.args == "-wrapper" and process.args : ("sh,-s", "bash,-s", "dash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s")] -[process where process.parent.name == "gcc" and process.name : ("bash", "sh", "dash")] +process where event.type == "start" and process.name in ("sh", "dash", "bash") and + process.parent.name == "gcc" and process.parent.args == "-wrapper" and + process.parent.args in ("sh,-s", "bash,-s", "dash,-s", "/bin/sh,-s", "/bin/bash,-s", "/bin/dash,-s") ''' diff --git a/rules/linux/execution_mysql_binary.toml b/rules/linux/execution_mysql_binary.toml index 3077a30b2..10514c846 100644 --- a/rules/linux/execution_mysql_binary.toml +++ b/rules/linux/execution_mysql_binary.toml @@ -25,9 +25,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where process.name == "mysql" and process.args == "-e" and process.args : ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")] -[process where process.parent.name == "mysql" and process.name : ("bash", "sh", "dash")] +process where event.type == "start" and process.name in ("bash", "sh", "dash") and + process.parent.name == "mysql" and process.parent.args == "-e" and + process.parent.args : ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash") ''' diff --git a/rules/linux/execution_nice_binary.toml b/rules/linux/execution_nice_binary.toml index 9e6a32283..5ce611e70 100644 --- a/rules/linux/execution_nice_binary.toml +++ b/rules/linux/execution_nice_binary.toml @@ -26,9 +26,8 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where event.type == "start" and process.name == "nice" and process.args : ("/bin/bash", "/bin/sh", "/bin/dash", "sh", "bash", "dash")] -[process where process.name : ("bash", "sh", "dash")] +process where event.type == "start" and process.name in ("bash", "sh", "dash") and + process.parent.name == "nice" and process.parent.args in ("/bin/bash", "/bin/sh", "/bin/dash", "sh", "bash", "dash") ''' diff --git a/rules/linux/execution_perl_tty_shell.toml b/rules/linux/execution_perl_tty_shell.toml index baf9c4323..9ec608508 100644 --- a/rules/linux/execution_perl_tty_shell.toml +++ b/rules/linux/execution_perl_tty_shell.toml @@ -39,4 +39,3 @@ reference = "https://attack.mitre.org/techniques/T1059/" id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" - diff --git a/rules/linux/execution_python_tty_shell.toml b/rules/linux/execution_python_tty_shell.toml index ebef8d618..ae959c002 100644 --- a/rules/linux/execution_python_tty_shell.toml +++ b/rules/linux/execution_python_tty_shell.toml @@ -41,4 +41,3 @@ reference = "https://attack.mitre.org/techniques/T1059/" id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" - diff --git a/rules/linux/execution_ssh_binary.toml b/rules/linux/execution_ssh_binary.toml index 3472dcb20..ce42c5028 100644 --- a/rules/linux/execution_ssh_binary.toml +++ b/rules/linux/execution_ssh_binary.toml @@ -25,9 +25,9 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by host.id, process.pid with maxspan=1m -[process where process.name == "ssh" and process.args == "-o" and process.args : ("ProxyCommand=;sh*", "ProxyCommand=;bash*", "ProxyCommand=;dash*", "ProxyCommand=;/bin/sh*", "ProxyCommand=;/bin/bash*", "ProxyCommand=;/bin/dash*")] -[process where process.parent.name == "ssh" and process.name : ("bash", "sh", "dash")] +process where event.type == "start" and process.name : ("bash", "sh", "dash") and + process.parent.name == "ssh" and process.parent.args == "-o" and + process.parent.args in ("ProxyCommand=;sh 0<&2 1>&2", "ProxyCommand=;bash 0<&2 1>&2", "ProxyCommand=;dash 0<&2 1>&2", "ProxyCommand=;/bin/sh 0<&2 1>&2", "ProxyCommand=;/bin/bash 0<&2 1>&2", "ProxyCommand=;/bin/dash 0<&2 1>&2") ''' diff --git a/rules/linux/execution_vi_binary.toml b/rules/linux/execution_vi_binary.toml index baa964553..c3cc2b525 100644 --- a/rules/linux/execution_vi_binary.toml +++ b/rules/linux/execution_vi_binary.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2022/03/03" maturity = "production" -updated_date = "2022/03/22" +updated_date = "2022/03/24" [rule] author = ["Elastic"]